Security audit

digital-employee-builder

Security checks across malware telemetry and agentic risk

Overview

This skill has a legitimate purpose, but its templates can create agents that use business credentials for live API changes and scheduled checks without strong built-in safeguards.

Install only if you intend to generate business-system agents and are prepared to review the generated workspace before use. Remove the API helper for self-contained Pattern C workflows, require least-privilege tokens, make dry-run or explicit execute flags mandatory for writes, and do not enable heartbeat or cron execution until its scope, cadence, data sources, and permissions are tightly defined.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The template's documentation says the default mode should be self-contained and zero-network, but the shipped implementation includes a ready-to-use network helper that performs authenticated HTTP requests. In a code-generation skill, templates strongly influence downstream output, so this mismatch can cause generated workflow scripts to reach live business systems unexpectedly and violate the intended safety model.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The docstring states that external API access should occur only after explicit user confirmation, yet the code path in run() directly uses api() with no such confirmation or enforcement. That discrepancy is dangerous because users and downstream agent builders may trust the safety claims while the generated script can immediately query or mutate production-connected services if environment variables are present.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The manifest advertises very broad trigger phrases such as 'digital employee' and 'turn a business system into an agent', which can cause the skill to activate for generic requests well beyond a narrowly scoped use case. In this skill, over-broad activation is more concerning because the skill drives codebase analysis, workspace generation, MCP wrapping, and script creation, so an unintended invocation could steer an agent into high-impact build or integration actions the user did not specifically request.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The template asks authors to fill in 'Trigger scenarios' as free text without constraining scope, specificity, or approval conditions. In a skill-generation context, that can produce workflows with overly broad activation criteria, causing an agent to invoke sensitive business actions in ambiguous situations or on weak user signals.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The template automatically sources API endpoint and bearer token values from environment variables, allowing generated scripts to authenticate to business systems without any user-facing notice at execution time. In an agent-workspace generator, this is especially risky because the resulting script may be run by operators who do not realize it will use ambient credentials and contact live services.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The template performs a live POST that can change remote state, and the only safety control is an optional dry-run mode rather than an explicit confirmation barrier for destructive or state-changing actions. Because this file is a reusable workflow template, it can propagate unsafe execution semantics into many generated employee scripts that may operate on sensitive business resources.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The heartbeat template instructs the generated agent to perform recurring checks using open-ended placeholders such as querying pending items and anomaly metrics, but it does not define strict activation conditions, scope limits, cadence, authorization boundaries, or notification rules. In a digital-employee generation context, this can cause downstream agents to poll systems continuously, access broader data than intended, or send unsolicited alerts/actions, increasing the risk of privacy leakage, operational noise, and unintended autonomous behavior.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The guidance explicitly recommends using cron or scheduled jobs to automatically execute HEARTBEAT instructions, which can cause the agent to perform actions without a human in the loop. In a skill whose purpose is to generate runnable agent workspaces and onboarding steps, this is more dangerous because downstream users may operationalize unattended execution across multiple harnesses without adding approval gates, dry-run modes, or scope limits.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.